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(54) Automatic discovery of networked devices 

(57) A method and apparatus (10) which allows a 
network adnninistrator to automatically populate a data- 
base (24) with nnore extensive information about 
devices (12) connected to the network, but at least with 
the hardware address of each device (12) on the net- 
work and enough information to communicate with the 
device (12) to obtain additional information if necessary. 
One embodiment of the invention provides several dif- 
ferent methods or discovery agents (27) for identifying 
devices (12) on the network. The discovery events (27) 
or processes can be initiated automatically as a result of 
a triggering event, such as system start-up. or at spe- 
cific scheduled times, or discovery events may be initi- 
ated manually by a user system administrator tiirough a 
user interface (21) on the network It also provides a 
modular framework to which new methods or expert 
agents can be added to provide better performance, 
more accurate results and/or lower network usage. 
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Description 

FIELD OF THE INVENTION 

[0001] This invention generally relates to detection 5 
and logging of networked devices. More partcularly, this 
Invention relates to an apparatus and method for dis- 
covering and togging networked devices automatically. 

BACKGROUND OF THE INVENTION 10 

[0002] Ck)nrputer networks have become a primary 
infrastructure in a large percentage of business, educa- 
tional and governmental entities. Even relatively small 
conrputer networks can employ a large nunrt^er of net- is 
work devices. Oftentimes two or nrore small networks 
are linked together, using a protocol known as TCP/IP 
(Transmission Control Protocol/Internet Protocol), to 
form a larger internet. These smaller networks and 
larger internets can be linked to the Internet which is an so 
international collection of internets that use the TCP/IP 
protocol. 

[OOOZ] Normally, every device within a TCP/IP based 
network is assigned a unique IP address which serves 
as its individual identifier Considering the relatively 25 
targe number of network devices which may be present 
on a given network and the dynamic nature of the net- 
work in terms of adding and subtracting devices to and 
from the network, physically relocated network devices 
on the network and logically grouping of the devices into 30 
local sub-nets, it is difficult at best to keep track of all of 
the IP addresses on the network and the network 
resources which those IP addresses are assigned. A 
network system administrator needs to track IP 
addresses and network resources in order to insure 35 
proper functioning of the network. The network adminis- 
trator needs to insure that no two devices on the net- 
work use the same IP address, insure that all IP 
addresses attached to the network are within the valid 
range for the particular network or local subnet and that 40 
both hardware and software limitatk}ns are not being 
exceeded for both the network and the devices attached 
to the network. 

[0004] US. Patent No. 5,337,309 to Robert Faulk. Jr., 
teaches a method and apparatus for collecting detailed 4S 
information about the layout and topology of a computer 
network. The patented device and method detects and 
records which port of a multiport network device other 
network devices comnnunicate with. These port num- 
bers are stored in a table which is updated by monitor- so 
ing packets received by the multiport network device. In 
addition to storing the port nun^er, the patented device 
and method also store a source address of the network 
device from which the communication packet origi- 
nated. This patent also teaches a recursive node dis- ss 
covery method for obtaining the port numbers and 
source addresses of the sending devices. 
[0005] Unfortunately, the aforementioned device and 
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method provide only a limited amount of information. 
Ideally, the system administrator of a network needs 
much more information about the network devices. This 
information may include IP addresses (internet protocol 
addresses) subnet nriasks; IP gateway addresses; secu- 
rity level assignment information; proxy server assign- 
ments; community names; device passwords; location 
descriptions; system contact; frame type selections: 
protocol stack selections; and even device behavior 
characteristics. It shoukl be apparent that manually 
gathering this wealth of information for each and every 
network device is nearly impossible. Unfortunately, the 
aforementioned method and device may also take con- 
siderable time and it doesn't handle unconfigured 
devices, nor does it handle other protocol stacks (IPX, 
Open Internetwork Packet exchange, for example). 
Accordingly, tiiere is a need for automatically collecting 
detailed information about tiie devices connected to a 
network. 

SUMMARY OF THE INVENTION 

[0006] One embodiment of the present inv^ion pro- 
vides a method and apparatus which allows a network 
administrator to automatically populate a database witii 
more extensive information at>out devices connected to 
the network, but at least witii the hardware address of 
each device on the network and enough information to 
communicate with the device to obtain additional infor- 
mation if necessary This embodiment of tiie invention 
provides several different methods or discovery agents 
for identifying devices on the network. The discovery 
events or processes can be initiated automatically as a 
result of a ti-iggering event, such as system start-up, or 
at specific scheduled times, or discovery events may be 
initiated manually by a user or system administrator 
tiirough a user interface on the network. It also provides 
a modular framework to which new methods or expert 
agents can be added to provide better performance, 
more accurate results and/or lower network usage. 
[0007] Normally, the software aspect of the invention 
resides on a network server or workstation which is con- 
nected to tiie subject network. A full time local connec- 
tion is desirable but not necessary In general tern^ the 
software includes: 1) an interlace; 2) a resdver; 3) a 
database; and 4) discovery agents. The interface pro- 
vides a user, such as tiie system administrator, with a 
way of inputting and receiving information to and from 
tiie invention. The resolver is responsible for acquiring 
specific Information from an identified network device. 
This information can then be stored in the database. 
The discovery agents are responsible for identifying net- 
work devices and communicating the network devices 
hardware and initial IP address settings to tiie resolver. 
These discovery agents, also referred to as address 
generating agents, can be integrated or separate and 
are used primarily to supply the resolver witii an IP 
address and/or MAC address for network devices not 
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already in the database. These agents can include a 
daemon which ovonitors the network for BOOTP (Boot- 
strap Protocol). DHCP (Dynamic Host Configuration 
Protocol) and/or similar broadcast packets. These 
agents can also include manually entering a hardware 5 
address/IP address, multicast packet monitoring, IPX 
packet monitoring and even proprietary network device 
notrficatron schemes. 

[0008] The invention can be implemented on a variety 
of network architectures, including ethernet and token 10 
ring architectures, enploying a variety of network proto- 
cols, including TCP/IP (Transmission Control Proto- 
col/Internet Protocol), IPX (Internetwork Packet 
Exchange), DLC (Data Link ControQ. and AppleTalk. 
[0009] As mentioned earlier, there are three primary is 
discovery initiating events which include system startup, 
system administrator initiated events and scheduled 
events. In one embodiment of the invention, a discovery 
daemon is started which checks to see if the database 
exists and, if it does, queries the database to see if it 20 
contains any data concerning the addresses of network 
devices. If the database does not exist or it is not popu- 
lated, a discovery event will be initiated. In this case, 
only a broadcast discovery is undertaken. Broadcast 
discoveries, while not as thorough as other methods, ss 
quickly populate the database. In the case of user or 
system administrator initiated discoveries and sched- 
uled discoveries, and in the event broadcast discovery 
methods have been disabled, the invention enrploys 
several other discovery methods. 30 
[0010] The discovery methods or agents employed by 
the invention include BOOTP broadcasts, DHCP broad- 
casts, multicast advertisments, IPX SAP(Service Adver- 
tisement Protocol) broadcasts, IP broadcasts, IPX 
broadcasts, IP pings, ARP (Address Resolution Proto- 35 
coQ table searches, user address searches, user host 
file input and multicast solicitat'on. The invention 
includes broadcast support for servers and host devices 
having multiple local area network interfaces. Addition- 
ally, in the case of IP pings, the invention uses multiple 4q 
threads to traverse a list of IP address ranges. Host files 
can be provided by the user to provide a list of host 
names, IP addresses, IPX addresses and/or MAC 
addresses. The ARP table discovery agent takes 
advantage of the Met that each IP capat)le device main- 45 
tains an ARP table. These ARP tables list all of the net- 
work nodes that the original node is in communication 
with. The table includes the MAC address and IP 
address of each node. The invention recursively 
searches each node, querying that node for all other so 
nodes of which it is aware. Additionally, the invention 
supports three levels of ARP table searching which 
include an unrestricted search, a local sub-net only 
search and a "local sub-net plus a designated number 
of hops away" search, where a "hop" is here defined as ss 
one device removed from the local subnet, that is to say 
that the device is referenced by a device on the focal 
subnet. 



DESCRIPTION OF THE DRAWINGS 
[0011] 

~Rg. 1 is a schematic representation of a network 
on which one emt^odiment of the invention may be 
implemented; 

Fig. 2 is a block diagram of the software aspect of 
one emtxxiiment of tiie invention; 
Rg. 3 is a schematic representation of a nonde- 
script network architecture on which the invention 
can be implemented; 

Fig. 4 is a flow diagram illustrating the software 
aspect of one embodiment of the invention which 
demonstrates the modularity feature of the soft- 
ware; 

Rg. 5 is a pseudo-code listing for an algorithm for 

unlimited ARP table searching; 

Rg. 6 is a pseudo-code listing for an algorithm for 

local subnet only ARP table searching; and 

Rg. 7 is a pseudo-code listing for an algorithm for 

local subnet plus one hop ARP table searching.-- 

DETAILED DESCRIPTION QF THE INVENTIO N 

[001 2] Referring now to the figures one embodiment 
of a system, software application and method for auto- 
matic discovery of networked devices is described in 
detail. The system is generally designated in Rg. 3 at 1 0 
and includes a host device 1 1 , such as a personal com- 
puter or workstation, and two or more network devices 
12. such as other computers or printers, which in this 
embodiment include network interface cards 14 such as 
Hewlett Packard® JetDirect® network cards, connected 
by a communications link such as cabling 13. Software 
20 according to the invention is installed on host device 
1 1 and may include an interface 21 . an interface trans- 
lator 22. a resotver 23, a database 24, a discovery dae- 
mon 25, various discovery agents 27 and a SNMP 
(Sinple Network Management Protocol) translator 26 
which communicates with the other network devices via 
tiie network 

[0013] Interface 21 provides a user, such as tiie sys- 
tem administrator, with a way of irputting and receiving 
irrformation to and from resotver 23 and database 24. 
Here, interface 21 is a web page interface which is dis- 
played on the display screen of host 1 1 . Interface 21 is 
in this enrtx)diment created by interface translator 21 
which displays a graphic user interface using HTML 
(Hyper Text Markup Language) and CGI (Computer 
Graphics Interface) compliant code. Interface 21 both 
displays network device information such as the availa- 
ble devices and their existing settings and parameters, 
and may even allow a user to change the settings and 
parameters and initiate reconfiguration sequences. 
[0014] Resolver 23 is responsikste for acquiring spe- 
cific information from an identified network device such 
as those shown at 12. This information can include 



3 



3/9/06, EAST Version: 2.0.3,0 



5 



EP 0 918 412 A2 



6 



details like the currently assigned IP address, the port 
nunnber, the hardware address, the IP hostname, the 
IPX name, the device nrodel, the IP gateway, a device 
description, a system contact, a device password, and 
device specific behavior characteristics. All or portions 5 
of the information returned by resolver 23 are normally 
stored in database 24. Database 24 can be as simple as 
a single flat file database stored on host 11 or rt can be 
more conplex such as a relational database which 
might include reference lookup tables containing addi- 
tional information about different devices which are 
likely to be attached to the network Additionally, 
resolver 23 can intent)gate a network device to discover 
if that particular device is aware of any other network 
devices which may not be in datat)ase 24. In this way, 
resolver 23 also becomes a discovery agent for locating 
additional network devices. 

[0015] Discovery daemon 25 is launched at system 
startup and is responsible for initiating initial discovery 
agents as well as monitoring the network for BOOTP, 
multicast advertisements. IPX SAP broadcasts and 
DHCP packet transmissions announcing new network 
devices. 

[0016] Integrated or separate discovery agents 27, 
also referred to as address generating agents, are used 
to supply resolver 23 with an IP address and/or MAC 
address for network devices 12 not already in database 
24. Agents 27 can include a daemon which monitors the 
network for BOOTP (Bootstrap ProtocoO. DHCP 
(Dynamic Host Configuration Protocol), multicast adver- 
tisements, IPX SAP broadcasts and/or similar broad- 
cast packets. These agents can also include oianually 
entering a hardware address/IP address, multicast 
packet monitoring, multicast solicitation, IPX packet 
monitoring and even proprietary network device notifi- 
cation schemes. 

[0017] Fig. 3 shows a nondescript network architec- 
ture which Is intended to illustrate the inventions immu- 
nity towards the position or hierarchy of other devices 
within a network. Host device 1 1 simply provides a res- 
idence for the software and the necessary hardware to 
carry out the software's instructions. Other network 
devices can include multi-functional devices such as 
secondary hosts 12a and single function devices such 
as printers, communication gateways, and the like, des- 
ignated at 12b. Their relative positioning within the sub- 
ject network is of little concern. 
[0018] A general discovery method employed by one 
embodiment of the invention is illustrated in Fig. 4. 
Beginning with the box near the top of Fig. 4, one or 
more discovery agents are triggered into action by one 
of three general events: system startup; a new or recon- 
figured device broadcast reception, user interface 
request; or a scheduled event. 
[001 9] At startup, discovery daemon 25 is launched at 
system startup. Discovery daemon 25 first checks for 
the existence of database 24. If it finds database 24. it 
queries the database to check for device entries. If dis- 



covery daemon 25 doesnt find database 24 or the data- 
base is not populated, discovery daemon 25 will launch 
one or more discovery agents 27 to populate database 
24. In this enrtKxiiment. the system default settings dic- 
tate that discovery daennon 25 launches only broadcast 
discovery agents such as IP agent 28, IPX agent 29. 
and/or DHCP agent 30. However, a system administra- 
tor or user can override these default settings and select 
one or more different discovery agents. After initial dis- 
covery is complete, if necessary, discovery daemon 25 
enters a monitoring mode in which it listens to the net- 
work for announcements, such as BOOTR and DHCP 
broadcasts, by newly connected or reconfigured net- 
work devices. 

[0020] In addition to startup and new/reconfigured 
device broadcast triggers, a request from user interface 
21 can trigger a discovery request. This request can be 
discovery agent specific such as requesting IP agent 28 
to service an IP address search request by the user, 
comprehensive using all available discovery agents to 
service an exhaustive resource discovery request by 
the user, or some combination of the two. Additionally, a 
scheduler daemon is 8dso launched at startup and will 
request discovery events at scheduled times such as 
every night at midnight to periodically update database 
24. The frequency and time for the scheduled discovery 
requests are tailorable by the system administrator or 
user. 

[0021] As is shown in Fig. 4 multiple discovery agent 
threads, as well as multiple threads of one or more dis- 
covery agents can be processed at the same time. The 
various discovery agents return newly discovered hard- 
ware and IP addresses to both database 24, where they 
are logged and to resolver 23. Resolver 23 queries the 
new network device for any additional information 
desired either by database 24 or the system administra- 
tor/user. X 

[0022] The discovery engine can be used to resolve 
an address for a user request as well. Here, interface 21 
passes the address in question to resolver 23 v^ich 
returns all of the information that can be obtained from 
the device at that particular address. 
[0023] For purposes of understanding the code listing 
in Figs. 5 through 7, the seed address is defined as the 
initial device address that has support for SNMP and 
has an ARP table that can be read in order to get 
started. Additionally, the differences between the algo- 
rithms are empasized in capitalized text. Fig. 5 is a 
psuedocode listing of the algorithm for implementing an 
unlimited, at least within the network firewall, recursive 
ARP table search. Fig. 6 is a psuedocode listing of the 
algorithm for implementing a subnet linruted recursive 
ARP table search. Fig. 7 is a psuedocode listing of the 
algorithm for inplementing a subnet plus one hop lim- 
ited recursive ARP table search. 
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Claims 

1. A method for populating a network resource data- 
base (24) on a host device (11) comprising the acts 

of: 5 

querying the database (24) for an entry; 
if an entry does not exist, launching a discovery 
agent (27) across an attached computer net- 
work employing a broadcast protocol to return w 
addresses of network devices (12) attached to 
the network; 

resolving the returned addresses into more 
detailed information about devices (12) located 
at the returned addresses; and is 
storing at least a portion of the information in 
the database (24). 

2. The method of claim 1 wherein the act of launching 

a discovery agent (27) includes monitoring the net- 20 
work for broadcasts selected from the group of 
broadcasts including BOOTR DHCP, multicast 
advertisments and IPX SAP. 

3. The method of claim 2 further conrprising the act of 25 
launching a discovery agent (27) selected from the 
group of discovery agents (27) including an IP 
agent (28), an IPX agent (29), a DHCP agent (30) 
and an ARP table search agent. 

30 

4. The method of claim 1 further comprising the act of 
launching a discovery agent (27) selected from the 
group of discovery agents (27) including an IP 
agent (28). an IPX agent (29), a DHCP agent (30) 
and an ARP taWe search agent. 35 

5. The method of claims 1 , 2, 3 or 4 wherein a discov- 
ery agent (27) is launched as a result of a system 
startc4> event. 

40 

6. The method of clain^ 1 , 2, 3 or 4 wherein a discov- 
ery agent (27) is launched as a result of a user 
request 

7. The method of claims 1 . 2, 3 or 4 wherein a discov- 45 
ery agent (27) is launched as a result of a scheduler 
daemon. 
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